Click to jump to signature section
Source: 4PVahP5GIa | Virustotal: Detection: 55% | Perma Link |
Source: Traffic | Snort IDS: 2030490 ET TROJAN ELF/MooBot Mirai DDoS Variant CnC Checkin M1 (Group String Len 1) 192.168.2.23:40150 -> 45.133.1.9:3074 |
Source: Traffic | Snort IDS: 2030489 ET TROJAN ELF/MooBot Mirai DDoS Variant Server Response 45.133.1.9:3074 -> 192.168.2.23:40150 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45638 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45640 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45644 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45648 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45650 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45652 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45654 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45658 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45660 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45664 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45666 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45668 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45670 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45672 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45674 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45678 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45680 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45708 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45734 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45744 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45746 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45750 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45752 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45754 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45756 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45758 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45760 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45764 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49390 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49392 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49404 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49408 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49418 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49424 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49430 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49434 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49440 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49450 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49452 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49458 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49462 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49476 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49478 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49484 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49488 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49494 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49502 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49508 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49514 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49520 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49526 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49530 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49536 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49542 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49550 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49554 |
Source: global traffic | TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443 |
Source: global traffic | TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80 |
Source: global traffic | TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443 |
Source: global traffic | TCP traffic: 192.168.2.23:40150 -> 45.133.1.9:3074 |
Source: /tmp/4PVahP5GIa (PID: 6269) | Socket: 127.0.0.1::6628 | Jump to behavior |
Source: unknown | DNS traffic detected: queries for: xbot.solutions |
Source: unknown | Network traffic detected: HTTP traffic on port 43928 -> 443 |
Source: unknown | Network traffic detected: HTTP traffic on port 42836 -> 443 |
Source: unknown | TCP traffic detected without corresponding DNS query: 91.189.91.43 |
Source: unknown | TCP traffic detected without corresponding DNS query: 109.202.202.202 |
Source: unknown | TCP traffic detected without corresponding DNS query: 40.38.221.190 |
Source: unknown | TCP traffic detected without corresponding DNS query: 128.85.172.245 |
Source: unknown | TCP traffic detected without corresponding DNS query: 19.132.127.190 |
Source: unknown | TCP traffic detected without corresponding DNS query: 200.192.149.163 |
Source: unknown | TCP traffic detected without corresponding DNS query: 85.173.58.128 |
Source: unknown | TCP traffic detected without corresponding DNS query: 169.149.8.21 |
Source: unknown | TCP traffic detected without corresponding DNS query: 216.253.29.142 |
Source: unknown | TCP traffic detected without corresponding DNS query: 105.152.147.226 |
Source: unknown | TCP traffic detected without corresponding DNS query: 211.115.102.51 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.27.250.11 |
Source: unknown | TCP traffic detected without corresponding DNS query: 44.126.35.120 |
Source: unknown | TCP traffic detected without corresponding DNS query: 86.241.59.241 |
Source: unknown | TCP traffic detected without corresponding DNS query: 171.94.171.7 |
Source: unknown | TCP traffic detected without corresponding DNS query: 223.11.237.248 |
Source: unknown | TCP traffic detected without corresponding DNS query: 130.81.12.245 |
Source: unknown | TCP traffic detected without corresponding DNS query: 39.206.84.255 |
Source: unknown | TCP traffic detected without corresponding DNS query: 223.86.201.253 |
Source: unknown | TCP traffic detected without corresponding DNS query: 126.44.249.130 |
Source: unknown | TCP traffic detected without corresponding DNS query: 101.75.73.111 |
Source: unknown | TCP traffic detected without corresponding DNS query: 16.80.71.119 |
Source: unknown | TCP traffic detected without corresponding DNS query: 136.17.187.81 |
Source: unknown | TCP traffic detected without corresponding DNS query: 143.208.47.30 |
Source: unknown | TCP traffic detected without corresponding DNS query: 130.9.42.201 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.130.164.200 |
Source: unknown | TCP traffic detected without corresponding DNS query: 206.165.1.182 |
Source: unknown | TCP traffic detected without corresponding DNS query: 126.248.163.157 |
Source: unknown | TCP traffic detected without corresponding DNS query: 22.197.23.201 |
Source: unknown | TCP traffic detected without corresponding DNS query: 50.0.229.98 |
Source: unknown | TCP traffic detected without corresponding DNS query: 85.17.24.135 |
Source: unknown | TCP traffic detected without corresponding DNS query: 13.80.73.115 |
Source: unknown | TCP traffic detected without corresponding DNS query: 241.231.203.77 |
Source: unknown | TCP traffic detected without corresponding DNS query: 25.67.78.104 |
Source: unknown | TCP traffic detected without corresponding DNS query: 143.221.17.224 |
Source: unknown | TCP traffic detected without corresponding DNS query: 202.59.116.57 |
Source: unknown | TCP traffic detected without corresponding DNS query: 35.26.86.251 |
Source: unknown | TCP traffic detected without corresponding DNS query: 60.179.172.16 |
Source: unknown | TCP traffic detected without corresponding DNS query: 83.196.39.241 |
Source: unknown | TCP traffic detected without corresponding DNS query: 205.228.128.0 |
Source: unknown | TCP traffic detected without corresponding DNS query: 173.158.92.255 |
Source: unknown | TCP traffic detected without corresponding DNS query: 96.148.42.90 |
Source: unknown | TCP traffic detected without corresponding DNS query: 44.121.27.220 |
Source: unknown | TCP traffic detected without corresponding DNS query: 120.81.101.254 |
Source: unknown | TCP traffic detected without corresponding DNS query: 93.193.26.67 |
Source: unknown | TCP traffic detected without corresponding DNS query: 253.0.185.111 |
Source: unknown | TCP traffic detected without corresponding DNS query: 178.201.185.211 |
Source: unknown | TCP traffic detected without corresponding DNS query: 148.94.248.255 |
Source: unknown | TCP traffic detected without corresponding DNS query: 208.175.231.152 |
Source: unknown | TCP traffic detected without corresponding DNS query: 185.109.35.63 |
Source: 4PVahP5GIa, type: SAMPLE | Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13 |
Source: 6269.1.00000000445626ef.00000000f6d81187.rw-.sdmp, type: MEMORY | Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13 |
Source: 6269.1.0000000032a4149d.000000005fe0fa1a.r-x.sdmp, type: MEMORY | Matched rule: SUSP_XORed_Mozilla date = 2019-10-28, author = Florian Roth, description = Detects suspicious single byte XORed keyword \'Mozilla/5.0\' - it uses yara\'s XOR modifier and therefore cannot print the XOR key. You can use the CyberChef recipe linked in the reference field to brute force the used key., reference = https://gchq.github.io/CyberChef/#recipe=XOR_Brute_Force(), score = , modified = 2022-05-13 |
Source: ELF static info symbol of initial sample | .symtab present: no |
Source: classification engine | Classification label: mal88.troj.evad.lin@0/53@1/0 |
Source: /usr/sbin/logrotate (PID: 6241) | Shell command executed: sh -c "\n\t\tinvoke-rc.d --quiet cups restart > /dev/null\n" logrotate_script "/var/log/cups/*log " | Jump to behavior |
Source: /usr/sbin/logrotate (PID: 6252) | Shell command executed: sh -c /usr/lib/rsyslog/rsyslog-rotate logrotate_script /var/log/syslog | Jump to behavior |
Source: /usr/sbin/invoke-rc.d (PID: 6244) | Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-enabled cups.service | Jump to behavior |
Source: /usr/sbin/invoke-rc.d (PID: 6250) | Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active cups.service | Jump to behavior |
Source: /usr/lib/rsyslog/rsyslog-rotate (PID: 6254) | Systemctl executable: /usr/bin/systemctl -> systemctl kill -s HUP rsyslog.service | Jump to behavior |
Source: /tmp/4PVahP5GIa (PID: 6269) | File: /tmp/4PVahP5GIa | Jump to behavior |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45638 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45640 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45644 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45648 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45650 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45652 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45654 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45658 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45660 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45664 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45666 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45668 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45670 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45672 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45674 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45678 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45680 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45708 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45734 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45744 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45746 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45750 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45752 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45754 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45756 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45758 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45760 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 45764 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49390 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49392 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49404 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49408 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49418 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49424 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49430 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49434 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49440 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49450 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49452 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49458 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49462 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49476 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49478 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49484 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49488 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49494 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49502 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49508 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49514 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49520 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49526 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49530 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49536 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49542 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49550 |
Source: unknown | Network traffic detected: HTTP traffic on port 23 -> 49554 |
Source: /usr/sbin/logrotate (PID: 6199) | Truncated file: /var/log/cups/access_log.1 | Jump to behavior |
Source: /usr/sbin/logrotate (PID: 6199) | Truncated file: /var/log/syslog.1 | Jump to behavior |
Source: /usr/bin/find (PID: 6239) | Queries kernel information via 'uname': | Jump to behavior |
Source: /tmp/4PVahP5GIa (PID: 6269) | Queries kernel information via 'uname': | Jump to behavior |
Source: 6245.20.dr | Binary or memory string: -9915837702310A--gzvmware kernel module |
Source: 6245.20.dr | Binary or memory string: -1116261022170A--gzQEMU User Emulator |
Source: 6245.20.dr | Binary or memory string: qemu-or1k |
Source: 6245.20.dr | Binary or memory string: qemu-riscv64 |
Source: 6245.20.dr | Binary or memory string: {cqemu |
Source: 6245.20.dr | Binary or memory string: qemu-arm |
Source: 6245.20.dr | Binary or memory string: (qemu |
Source: 6245.20.dr | Binary or memory string: qemu-tilegx |
Source: 6245.20.dr | Binary or memory string: qemu-hppa |
Source: 6245.20.dr | Binary or memory string: q{rqemu% |
Source: 6245.20.dr | Binary or memory string: )qemu |
Source: 6245.20.dr | Binary or memory string: vmware-toolbox-cmd |
Source: 6245.20.dr | Binary or memory string: qemu-ppc |
Source: 4PVahP5GIa, 6269.1.0000000043c7449e.00000000c606710f.rw-.sdmp | Binary or memory string: U!/etc/qemu-binfmt/mipsel |
Source: 6245.20.dr | Binary or memory string: Tqemu9 |
Source: 6245.20.dr | Binary or memory string: qemu-aarch64_be |
Source: 6245.20.dr | Binary or memory string: 0qemu9 |
Source: 6245.20.dr | Binary or memory string: qemu-sparc64 |
Source: 6245.20.dr | Binary or memory string: qemu-mips64 |
Source: 6245.20.dr | Binary or memory string: vV:qemu9 |
Source: 6245.20.dr | Binary or memory string: qemu-ppc64le |
Source: 6245.20.dr | Binary or memory string: <glib::param::uint64Glib::Param::UInt643pm315820097650A--gzWrapper for uint64 parameters in GLibx86_64-linux-gnu-ld.gold-1116112426130B--gzThe GNU ELF linkerprinter-profile-1115804162510A--gzProfile using X-Rite ColorMunki and Argyll CMSgrub-fstest-1116214898500A--gzdebug tool for GRUB filesystem driversxdg-user-dir-1115483406210A--gzFind an XDG user dirkmodsign-1115569251480A--gzKernel module signing toolsensible-editor-1115739932820A--gzsensible editing, paging, and web browsingminesMines6615854478170Cgnome-mines-gzinputattach-1115708189280A--gzattach a serial line to an input-layer devicegapplication-1116155671180A--gzD-Bus application launcherip-tunnel-8815816145190A--gztunnel configurationkoi8rxterm-1116140167530A--gzX terminal emulator for KOI8-R environmentsfoo2hiperc-wrapper-1115804162510A-tgzConvert Postscript into a HIPERC printer streamcryptsetup-reencrypt-8816002888050A--gztool for offline LUKS device re-encryptionsyndaemon-1115861716810A--gza program that monitors keyboard activity and disables the touchpad when the keyboard is being used.gslj-1115980290200B--gzFormat and print text for LaserJet printer using ghostscriptfile2brl-1115757179490A--gzTranslate an xml or a text file into an embosser-ready braille filexfdesktop-settings-1115793419820A--gzDesktop settings for Xfceua-1115856013570B--gzManage Ubuntu Advantage services from Canonicallatin4-7715812813670B--gzISO 8859-4 character set encoded in octal, decimal, and hexadecimalsane-genesys-5516003468200A--gzSANE backend for GL646, GL841, GL843, GL847 and GL124 based USB flatbed scannerspdftohtml-1115853266670A--gzprogram to convert PDF files into HTML, XML and PNG imagesbluetooth-sendto-1116015653360A--gzGTK application for transferring files over Bluetoothqemu-ppc64-1116261022170B--gzQEMU User Emulatorcache_metadata_size-8815811608350A--gzEstimate the size of the metadata device needed for a given configuration.net::dbus::exporterNet::DBus::Exporter3pm315773746310A--gzExport object methods and signals to the bussane-pint-5516003468200A--gzSANE backend for scanners that use the PINT device driverbpf-helpers7-7715812813670A--gzlist of eBPF helper functionsfull-4415812813670A--gzalways full devicelogin-1115906478670A--gzbegin session on the systemcups-snmp-8815877390340A--gzcups snmp backend (deprecated)ordchr-3am315728089600A--gzconvert characters to strings and vice versasosreport-1116092694050A--gzCollect and package diagnostic and support datatop-111582782727 |